Our antivirus switched itself off. Is that a sign of compromise?

It can be. Switching off security tools is a common early step for attackers and ransomware, because it removes a witness before the real work starts. Check the endpoint console for who or what changed the setting and when, look for new administrator accounts, new services and scheduled tasks on that machine, and isolate it if you cannot explain the change. Ask the vendor's support whether an update could have done it; sometimes that is the answer. This is endpoint evidence: a network sensor does not see a setting change on a computer. What it can show is whether that machine then started behaving unusually on the network, such as contacting a new outside server at regular intervals or opening sessions to other hosts, which NetSenX flags on every plan.

← All 35 questions on Have I been hacked?All topics